AI Chatbot Phishing Assistant Scam on WhatsApp
A fake AI 'customer support assistant' on WhatsApp Business chats naturally with users, answering questions convincingly before steering them toward a phishing link or a direct request for payment details.
Part of: AI Chatbot Phishing Assistant Scam
Last reviewed: 5 July 2026
Automated assistants on WhatsApp Business are normal; real banks, couriers, and utilities use them daily, which lets a fraudulent one blend in. The AI-driven version holds a fluid, on-topic conversation, referencing order numbers and answering skepticism with plausible reassurance, never tripping the stilted-bot instincts people rely on. Partway through, it produces a 'verification link' for a delivery issue or locked account, leading to a page that harvests logins or card details. The distinction that matters most: conversational fluency is now cheap and proves nothing about identity, so judge the request and the link, never the quality of the chat.
How this scam works on WhatsApp
A message arrives from a WhatsApp Business account styled like a bank, delivery company, or utility provider, powered by an AI chatbot that can answer follow-up questions naturally, reference order numbers, and adjust its tone based on what the victim types. This fluidity builds trust quickly, since the bot doesn't feel like the rigid keyword-matching systems people are used to distrusting.
Partway through the conversation, the bot introduces a 'verification link' to resolve a delivery issue, unlock an account, or claim a refund, leading to a phishing page that harvests login credentials or card details. Because the AI can respond to skepticism with reassuring, contextually appropriate answers, victims who raise doubts are often talked past them rather than shut down by a bot that can't understand the question.
Common red flags
- A WhatsApp Business account with a generic or slightly misspelled company name and no verified green checkmark
- Conversation flows unusually smoothly and adapts to unrelated questions, which is unusual for genuine automated support
- A verification or refund link is introduced mid-conversation that leads off WhatsApp to an unfamiliar domain
- Requests for a one-time passcode, full card number, or banking password during the chat
- The account was only created recently or has no prior message history when checked
- Urgency framing such as a delivery being held or an account being suspended unless you act immediately
How to protect yourself
- Verify a business account's green checkmark and cross-check the number against the company's official website contact page
- Never click links sent through an unsolicited WhatsApp chat, even if the conversation feels natural and well-informed
- Go directly to the company's official app or website to resolve any account or delivery issue instead of using the chat link
- Never share a one-time passcode, password, or full card number in a chat, regardless of how legitimate it sounds
- Ask the bot a question only the real company could reasonably know; inconsistent or evasive answers are a warning sign
- Report and block suspicious business accounts rather than continuing the conversation to 'test' them
How to report it
- Report and block the business account directly within WhatsApp using the in-app report feature
- Report the impersonated company name to the real business's fraud or security team
- Forward details to your national cybercrime or consumer protection reporting center
- Report any resulting financial loss to your bank immediately
Frequently asked questions
Can I ask the chatbot to prove it's from the real company?
This isn't a reliable test, since an AI-driven bot can often give plausible-sounding answers to challenge questions. It's safer to close the chat and verify your account or order status directly through the company's official app or website.
Is it safe to message a WhatsApp Business number I found through a search ad?
Not necessarily. Verify the number against the contact details published on the company's official website rather than trusting a search result or ad, since both can be spoofed or hijacked.
I already shared a one-time passcode with the bot, what should I do now?
Contact the real company through its official app or verified phone number immediately to lock down your account, change your password, and check for any unauthorized activity.
How is this different from an old-style scam chatbot?
AI-driven bots can hold a natural, adaptive conversation and respond convincingly to follow-up questions, making them harder to spot than the rigid keyword-based bots people learned to distrust.
Can a business account with a verified checkmark still be part of a scam?
Verified badges reduce risk but don't eliminate it entirely; always verify the link and never share sensitive credentials in chat regardless of verification status.